Security & Operations

SDK Integration Troubleshooting

Diagnose Trading Widget, Agent SDK, signing, webhook, timeout, and environment problems before escalating a support request.
View as Markdown

Start with the environment, timestamp, and business identifier for the failed operation. A structured check usually separates configuration problems from authentication, network, and asynchronous-processing issues.

Recommended diagnostic order

  1. Confirm the affected environment and base URL.
  2. Record the UTC time range and the first failing request.
  3. Identify the module: Trading Widget, Agent SDK, REST API, WebSocket, or webhook.
  4. Capture the request ID, partner user ID, agentOrderNo, order ID, or webhook event ID.
  5. Check recent code, credential, IP whitelist, or deployment changes.
  6. Reproduce with the smallest safe test case.

Trading Widget issues

SymptomLikely causeFix
iframe requests partner local domainbaseUrl is missingPass baseUrl: ā€˜https://app.6mm.comā€™.
iframe is invisible or very shortParent container has no heightSet container height or pass height.
token_provider_missingpartner-token mode has no providerAdd auth.tokenProvider.
auth_exchange_failedInvalid, expired, or mismatched embed tokenCheck backend token response and channelId.

Agent SDK issues

SymptomLikely causeFix
Signature rejectedWrong secret, clock drift, or manually changed signed fieldsLet SDK generate signing fields and sync server time.
Duplicate funds movement riskNew order number used after timeoutQuery by original agentOrderNo first.
PROCESSING treated as failurePending state misunderstoodWait for webhook or call queryOrder.
Webhook processed multiple timesRetry behavior without idempotencyAdd idempotency key and final-state checks.

Evidence to capture

IntegrationUseful evidence
Trading WidgetPage URL, SDK version path, browser console, failed network requests, onError payload, and container dimensions.
Agent SDKSDK language/version, base URL, UTC timestamp, request ID, agentOrderNo, response code, and sanitized logs.
WebhookDelivery time, event or business key, signature-validation result, processing state, and sanitized raw-body hash.
REST APIMethod, path, environment, request ID, response code, and sanitized parameters.

Never include passwords, access tokens, API secrets, full signatures, private keys, or unredacted personal data in diagnostics.

Before escalating

  • Retry only when the operation is documented as safe to retry.
  • After a timeout, query the original business identifier instead of creating a new one.
  • Confirm the system clock and credential environment for signature errors.
  • Preserve the first failure and any later retry results.
  • Use the Support Request Template to send a complete, redacted report.
Trading Widget Quick Start

Verify script loading, container size, configuration, and callbacks.

Secrets & Signing

Check Agent SDK credentials, clocks, and signed fields.

Webhooks & Idempotency

Review callback verification and duplicate-event handling.